diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml new file mode 100644 index 0000000000..80d880244c --- /dev/null +++ b/.github/workflows/nightly.yml @@ -0,0 +1,47 @@ +name: Nightly Security Scan +on: + schedule: + - cron: '0 0 * * *' # 12am UTC daily runtime + workflow_dispatch: + +jobs: + scan-image: + name: Scan Docker Image + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + with: + submodules: recursive + - name: Build the Docker image + run: docker build . -t appwrite_image:latest + - name: Run Trivy vulnerability scanner on image + uses: aquasecurity/trivy-action@0.20.0 + with: + image-ref: 'appwrite_image:latest' + format: 'sarif' + output: 'trivy-image-results.sarif' + ignore-unfixed: 'false' + severity: 'CRITICAL,HIGH' + - name: Upload Docker Image Scan Results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-image-results.sarif' + + scan-code: + name: Scan Code + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + - name: Run Trivy vulnerability scanner on filesystem + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: 'fs' + format: 'sarif' + output: 'trivy-fs-results.sarif' + severity: 'CRITICAL,HIGH' + - name: Upload Code Scan Results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-fs-results.sarif' diff --git a/.github/workflows/pr-scan.yml b/.github/workflows/pr-scan.yml index af510ccc3b..eded58985d 100644 --- a/.github/workflows/pr-scan.yml +++ b/.github/workflows/pr-scan.yml @@ -1,17 +1,22 @@ name: PR Security Scan -on: - pull_request: +on: + pull_request_target: types: [opened, synchronize, reopened] - workflow_dispatch: + jobs: scan: runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write steps: - - name: Check out code + - name: Check out code uses: actions/checkout@v4 with: + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 submodules: 'recursive' + - name: Build the Docker image uses: docker/build-push-action@v5 with: @@ -19,6 +24,7 @@ jobs: push: false load: true tags: pr_image:${{ github.sha }} + - name: Run Trivy vulnerability scanner on image uses: aquasecurity/trivy-action@0.20.0 with: @@ -26,6 +32,7 @@ jobs: format: 'json' output: 'trivy-image-results.json' severity: 'CRITICAL,HIGH' + - name: Run Trivy vulnerability scanner on source code uses: aquasecurity/trivy-action@0.20.0 with: @@ -34,10 +41,11 @@ jobs: format: 'json' output: 'trivy-fs-results.json' severity: 'CRITICAL,HIGH' - - name: Process and post Trivy scan results + + - name: Process Trivy scan results + id: process-results uses: actions/github-script@v7 with: - github-token: ${{secrets.GITHUB_TOKEN}} script: | const fs = require('fs'); let commentBody = '## Security Scan Results for PR\n\n'; @@ -79,9 +87,19 @@ jobs: commentBody += 'Please contact the core team for assistance.'; } - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: commentBody - }); + core.setOutput('comment-body', commentBody); + - name: Find Comment + uses: peter-evans/find-comment@v3 + id: fc + with: + issue-number: ${{ github.event.pull_request.number }} + comment-author: 'github-actions[bot]' + body-includes: Security Scan Results for PR + + - name: Create or update comment + uses: peter-evans/create-or-update-comment@v3 + with: + issue-number: ${{ github.event.pull_request.number }} + comment-id: ${{ steps.fc.outputs.comment-id }} + body: ${{ steps.process-results.outputs.comment-body }} + edit-mode: replace diff --git a/README.md b/README.md index 738de5c67c..a9856a7310 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -> Our Appwrite Init event has concluded. You can check out all the new and upcoming features [on our Init website](https://appwrite.io/init) 🚀 +> Appwrite Init has concluded! You can check out all the latest announcements [on our Init website](https://appwrite.io/init) 🚀

@@ -134,6 +134,12 @@ Choose from one of the providers below:
Akamai Compute + + + AWS Logo +
AWS Marketplace + + diff --git a/app/config/function-templates.php b/app/config/function-templates.php index 4b58cc44be..db26ff2c19 100644 --- a/app/config/function-templates.php +++ b/app/config/function-templates.php @@ -82,7 +82,7 @@ return [ 'providerOwner' => 'appwrite', 'providerVersion' => '0.2.*', 'variables' => [], - 'scopes' => ["users.read"] + 'scopes' => ['users.read'] ], [ 'icon' => 'icon-upstash', @@ -125,7 +125,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-redis', @@ -167,7 +168,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-neo4j', @@ -217,7 +219,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-mongodb', @@ -253,7 +256,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-neon', @@ -320,7 +324,8 @@ return [ 'required' => true, 'type' => 'text' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-open-ai', @@ -380,7 +385,8 @@ return [ 'required' => false, 'type' => 'number' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-discord', @@ -442,7 +448,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-perspective-api', @@ -476,7 +483,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-pangea', @@ -523,7 +531,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-document', @@ -543,7 +552,8 @@ return [ 'providerRepositoryId' => 'templates', 'providerOwner' => 'appwrite', 'providerVersion' => '0.2.*', - 'variables' => [] + 'variables' => [], + 'scopes' => [] ], [ 'icon' => 'icon-github', @@ -586,7 +596,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-bookmark', @@ -637,7 +648,7 @@ return [ 'type' => 'url' ] ], - 'scopes' => ["databases.read", "databases.write", "collections.write", "attributes.write", "documents.read", "documents.write"] + 'scopes' => ['databases.read', 'databases.write', 'collections.write', 'attributes.write', 'documents.read', 'documents.write'] ], [ 'icon' => 'icon-algolia', @@ -718,7 +729,7 @@ return [ 'type' => 'password' ], ], - 'scopes' => ["databases.read", "collections.read", "documents.read"] + 'scopes' => ['databases.read', 'collections.read', 'documents.read'] ], [ 'icon' => 'icon-meilisearch', @@ -811,7 +822,7 @@ return [ 'type' => 'text' ], ], - 'scopes' => ["databases.read", "collections.read", "documents.read"] + 'scopes' => ['databases.read', 'collections.read', 'documents.read'] ], [ 'icon' => 'icon-vonage', @@ -896,7 +907,8 @@ return [ 'required' => true, 'type' => 'phone' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-bell', @@ -951,7 +963,8 @@ return [ 'required' => true, 'type' => 'url' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-mail', @@ -1033,7 +1046,8 @@ return [ 'required' => false, 'type' => 'text' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-stripe', @@ -1074,7 +1088,7 @@ return [ 'type' => 'password' ] ], - 'scopes' => ["users.read", "sessions.write", "users.write"] + 'scopes' => ['users.read', 'sessions.write', 'users.write'] ], [ 'icon' => 'icon-stripe', @@ -1131,7 +1145,7 @@ return [ 'type' => 'text' ] ], - 'scopes' => ["databases.read", "databases.write", "collections.write", "attributes.write", "documents.read", "documents.write"] + 'scopes' => ['databases.read', 'databases.write', 'collections.write', 'attributes.write', 'documents.read', 'documents.write'] ], [ 'icon' => 'icon-chat', @@ -1164,7 +1178,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-translate', @@ -1197,7 +1212,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-eye', @@ -1255,7 +1271,7 @@ return [ 'type' => 'password' ] ], - 'scopes' => ["databases.read", "databases.write", "collections.read", "collections.write", "attributes.write", "documents.read", "documents.write", "buckets.read", "buckets.write", "files.read"] + 'scopes' => ['databases.read', 'databases.write', 'collections.read', 'collections.write', 'attributes.write', 'documents.read', 'documents.write', 'buckets.read', 'buckets.write', 'files.read'] ], [ 'icon' => 'icon-eye', @@ -1313,7 +1329,7 @@ return [ 'type' => 'password' ] ], - "scopes" => ["databases.read", "databases.write", "collections.read", "collections.write", "attributes.write", "documents.read", "documents.write", "buckets.read", "buckets.write", "files.read"] + 'scopes' => ['databases.read', 'databases.write', 'collections.read', 'collections.write', 'attributes.write', 'documents.read', 'documents.write', 'buckets.read', 'buckets.write', 'files.read'] ], [ 'icon' => 'icon-text', @@ -1371,7 +1387,7 @@ return [ 'type' => 'password' ] ], - "scopes" => ["databases.read", "databases.write", "collections.read", "collections.write", "attributes.write", "documents.read", "documents.write", "buckets.read", "buckets.write", "files.read"] + 'scopes' => ['databases.read', 'databases.write', 'collections.read', 'collections.write', 'attributes.write', 'documents.read', 'documents.write', 'buckets.read', 'buckets.write', 'files.read'] ], [ 'icon' => 'icon-chat', @@ -1429,7 +1445,7 @@ return [ 'type' => 'password' ] ], - "scopes" => ["buckets.read", "buckets.write", "files.read", "files.write"] + 'scopes' => ['buckets.read', 'buckets.write', 'files.read', 'files.write'] ], [ 'icon' => 'icon-chip', @@ -1463,7 +1479,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-chip', @@ -1505,7 +1522,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["buckets.write", "files.read", "files.write"] + 'scopes' => ['buckets.write', 'files.read', 'files.write'] ], [ 'icon' => 'icon-chip', @@ -1579,7 +1596,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-document-search', @@ -1642,7 +1660,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["databases.read", "collections.read", "documents.read"] + 'scopes' => ['databases.read', 'collections.read', 'documents.read'] ], [ 'icon' => 'icon-chip', @@ -1705,7 +1723,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["databases.read", "collections.read", "documents.read"] + 'scopes' => ['databases.read', 'collections.read', 'documents.read'] ], [ 'icon' => 'icon-chat', @@ -1760,7 +1778,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["buckets.read", "buckets.write", "files.read", "files.write"] + 'scopes' => ['buckets.read', 'buckets.write', 'files.read', 'files.write'] ], [ 'icon' => 'icon-chip', @@ -1801,7 +1819,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["buckets.read", "buckets.write", "files.read", "files.write"] + 'scopes' => ['buckets.read', 'buckets.write', 'files.read', 'files.write'] ], [ 'icon' => 'icon-chip', @@ -1841,7 +1859,8 @@ return [ 'required' => false, 'type' => 'number' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-music-note', @@ -1883,7 +1902,7 @@ return [ 'type' => 'password' ] ], - "scopes" => ["buckets.read", "buckets.write", "files.read", "files.write"] + 'scopes' => ['buckets.read', 'buckets.write', 'files.read', 'files.write'] ], [ 'icon' => 'icon-chip', @@ -1917,7 +1936,8 @@ return [ 'required' => true, 'type' => 'password' ] - ] + ], + 'scopes' => [] ], [ 'icon' => 'icon-currency-dollar', @@ -1972,7 +1992,7 @@ return [ 'type' => 'text' ] ], - "scopes" => ["users.read", "users.write"] + 'scopes' => ['users.read', 'users.write'] ], [ 'icon' => 'icon-currency-dollar', @@ -2043,6 +2063,6 @@ return [ 'type' => 'text' ] ], - "scopes" => ["users.read", "users.write"] + 'scopes' => ['users.read', 'users.write'] ] ]; diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 0cb88d31fa..6d87940ff7 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -602,10 +602,11 @@ App::shutdown() /** * Trigger functions. */ - $queueForFunctions - ->from($queueForEvents) - ->trigger(); - + if (!$queueForEvents->isPaused()) { + $queueForFunctions + ->from($queueForEvents) + ->trigger(); + } /** * Trigger webhooks. */ diff --git a/app/views/install/compose.phtml b/app/views/install/compose.phtml index 0124dbad01..8f83fed544 100644 --- a/app/views/install/compose.phtml +++ b/app/views/install/compose.phtml @@ -679,6 +679,7 @@ $image = $this->getParam('image', ''); entrypoint: worker-usage-dump <<: *x-logging container_name: appwrite-worker-usage-dump + restart: unless-stopped networks: - appwrite depends_on: @@ -792,7 +793,7 @@ $image = $this->getParam('image', ''); <<: *x-logging restart: unless-stopped stop_signal: SIGINT - image: openruntimes/executor:0.6.7 + image: openruntimes/executor:0.6.11 networks: - appwrite - runtimes diff --git a/docker-compose.yml b/docker-compose.yml index 4d91f61a70..6ecb0ecff8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -874,7 +874,7 @@ services: hostname: exc1 <<: *x-logging stop_signal: SIGINT - image: openruntimes/executor:0.6.7 + image: openruntimes/executor:0.6.11 restart: unless-stopped networks: - appwrite diff --git a/public/images/integrations/aws-logo.svg b/public/images/integrations/aws-logo.svg new file mode 100644 index 0000000000..3ab41cde07 --- /dev/null +++ b/public/images/integrations/aws-logo.svg @@ -0,0 +1,38 @@ + + + + + + + + + + + +